Skill Trust Decision
x-daily-report
Skill performs undeclared credential-based API access with a hardcoded API key and reads a Feishu access token from environment variables, while SKILL.md explicitly claims 'zero cost, no API needed' for the free scraper and makes no mention of credential requirements or external API calls.
Most direct threat evidence
01
SKILL.md advertises 'zero-cost, no API key needed' to attract users Entry · SKILL.md
02
Chrome browser cookie access usesCookiesFromBrowser('chrome') for X session reuse, silently reading authentication state reconnaissance · scripts/x-scraper-free.js
03
Hardcoded X_API_KEY = 'THp2c1V4bW5JQVJ1S09IY1BzN1NubDoxaXJpUQ' embedded in source with 'auto-obtained' comment, harvesting API credentials Escalation · scripts/x-monitor.js
Why this conclusion was reached
3/4 dimensions flagged Block
Declared vs actual capability
4 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 6 attack-chain steps and 3 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
SKILL.md advertises 'zero-cost, no API key needed' to attract users
Entry · SKILL.md:7
02
Chrome browser cookie access usesCookiesFromBrowser('chrome') for X session reuse, silently reading authentication state
reconnaissance · scripts/x-scraper-free.js:82
03
Hardcoded X_API_KEY = 'THp2c1V4bW5JQVJ1S09IY1BzN1NubDoxaXJpUQ' embedded in source with 'auto-obtained' comment, harvesting API credentials
Escalation · scripts/x-monitor.js:11
04
process.env.FEISHU_ACCESS_TOKEN read for external API authorization, undeclared environment access
reconnaissance · scripts/x-monitor.js:14
05
Hardcoded BITABLE_APP_TOKEN and API calls to https://open.feishu.cn expose Feishu integration without user disclosure
Exfiltration · scripts/x-monitor.js:5
06
SKILL.md documents cron job setup for scheduled execution, enabling persistent background monitoring
Persistence · SKILL.md:48
What drove the risk score up
Hardcoded API key not declared in SKILL.md +25
scripts/x-monitor.js line 11 exposes X_API_KEY = 'THp2c1V4bW5JQVJ1S09IY1BzN1NubDoxaXJpUQ' with comment '已自动获取' (auto-obtained), and SKILL.md never mentions any API key requirement
Undeclared environment variable access +15
x-monitor.js line 8 reads process.env.FEISHU_ACCESS_TOKEN without declaring environment:READ in allowed tools or documenting the Feishu integration in SKILL.md
SKILL.md / code capability mismatch +15
SKILL.md declares '零成本运行：无需X开发者账号' but the API mode (x-monitor.js) requires hardcoded credentials; free-mode credential access via Chrome browser cookies is also absent from SKILL.md
Undeclared network access to external services +10
Feishu API (https://open.feishu.cn) and X API calls are not mentioned anywhere in SKILL.md
Most important evidence
High Credential Theft
Hardcoded X API Key with 'auto-obtained' comment
scripts/x-monitor.js line 11 hardcodes X_API_KEY = 'THp2c1V4bW5JQVJ1S09IY1BzN1NubDoxaXJpUQ' with the comment '已自动获取' (auto-obtained), implying the credential was harvested without user consent. The secret portion is partially masked as '••••••••••1ibiPw' but still in plaintext in source. SKILL.md declares '零成本运行：无需X开发者账号' (zero cost, no X developer account needed), which directly contradicts this.
scripts/x-monitor.js:11 Remove hardcoded credentials. Use environment variables exclusively (process.env.X_API_KEY) and document the required credential setup in SKILL.md. Remove the 'auto-obtained' comment and clarify credential sourcing.
High Doc Mismatch
SKILL.md claims zero-cost no-API mode but code requires credentials
SKILL.md advertises '✅ 零成本运行：支持免费无API爬虫模式，无需X开发者账号' and '自动登录：复用浏览器已登录的X会话，无需输入账号密码'. However, x-monitor.js (the alternative entry point) uses hardcoded credentials, and even the free scraper accesses Chrome browser cookies without declaring this in SKILL.md. The Feishu/Bitable integration and external API calls are entirely absent from SKILL.md.
SKILL.md:1 Update SKILL.md to declare: (1) Chrome browser cookie access for authentication, (2) Feishu/Bitable API credential requirements (FEISHU_ACCESS_TOKEN), (3) All external API endpoints called (Feishu, X API), (4) Credential sourcing for the API mode.
High Sensitive Access
Undeclared Feishu API access with hardcoded App Token
scripts/x-monitor.js lines 5-8 hardcode BITABLE_APP_TOKEN, BITABLE_TABLE_ID, and the Feishu API base URL. The code reads process.env.FEISHU_ACCESS_TOKEN for authorization. This Feishu integration is not declared anywhere in SKILL.md. The hardcoded app token could allow enumeration or data access if the token is valid and permissions are broad.
scripts/x-monitor.js:5 Move all Feishu configuration to environment variables and document the required FEISHU_ACCESS_TOKEN in SKILL.md. Consider whether the bitable account list should be sourced externally at all.
Medium Doc Mismatch
Browser cookie access declared only in skill-card.md, absent from SKILL.md
scripts/x-scraper-free.js line 82 calls scraper.useCookiesFromBrowser('chrome') to reuse an authenticated Chrome X/Twitter session. skill-card.md mentions this as a 'known risk', but SKILL.md — the primary user-facing documentation — does not mention it at all. This creates a documentation gap where most users will be unaware of the browser session access.
scripts/x-scraper-free.js:82 Add explicit documentation in SKILL.md under the free scraper mode explaining that Chrome browser cookies are accessed for X authentication.
Medium Supply Chain
Unpinned npm dependencies with wildcard version ranges
package.json declares '@the-convocation/twitter-scraper': '^0.22.1' and 'axios': '^1.6.0'. The caret (^) allows minor/patch updates. This introduces supply chain risk: a compromised package update could be automatically pulled and executed with full filesystem and network permissions.
package.json:12 Pin exact versions (remove ^) and consider using a lockfile (package-lock.json or yarn.lock) to ensure reproducible builds. Audit the twitter-scraper package's permissions and network behavior.
Medium Doc Mismatch
Undeclared file write operations
Both scripts write generated reports to disk (x-daily-report-*.md) using Node.js writeFile. SKILL.md mentions '生成行业趋势报告' and file output is implied by '结构化日报', but the actual file write operations and the local storage path are not explicitly documented as filesystem:WRITE operations.
scripts/x-scraper-free.js:183 Document that the skill writes dated Markdown reports to the scripts/ directory. Consider making the output path configurable and declaring it as a filesystem:WRITE capability.
Low Sensitive Access
x-monitor.js uses mock/simulated data that could mask real credential usage
x-monitor.js getAccountTweets() function generates mock tweet data and has a comment '模拟 X API 调用，实际使用时替换为真实 API 请求'. While this may be intentional for testing, the combination of mock data + hardcoded credentials means real credential usage is unclear. The API key is present but the function doesn't make real X API calls in the current code, which is deceptive about the actual data source.
scripts/x-monitor.js:33 Either remove the hardcoded API key since it is not actively used, or fully implement real X API integration and remove the mock data.
Declared capability vs actual capability
Network Block
Declared NONE
→ Inferred READ
scripts/x-monitor.js:8,14 — axios.get/post to Feishu API and X API; scripts/x-scraper-free.js — uses twitter-scraper which makes network requests to X.com Environment Block
Declared NONE
→ Inferred READ
scripts/x-monitor.js:14 — reads process.env.FEISHU_ACCESS_TOKEN; SKILL.md does not declare any environment variable access Filesystem Block
Declared NONE
→ Inferred WRITE
scripts/x-scraper-free.js:183, scripts/x-monitor.js:178 — writeFile saves .md report to disk; SKILL.md does not declare file write operations Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md documents 'node scripts/x-scraper-free.js' and 'node scripts/x-monitor.js' bash invocations; in line with allowed-tools mapping (Bash→shell:WRITE) Browser Block
Declared NONE
→ Inferred READ
scripts/x-scraper-free.js:82 — scraper.useCookiesFromBrowser('chrome') accesses Chrome browser cookies for X session authentication; declared only in skill-card.md, not in SKILL.md Suspicious artifacts and egress
High API Key
API_KEY = 'THp2c1V4bW5JQVJ1S09IY1BzN1NubDoxaXJpUQ' scripts/x-monitor.js:11
Medium External URL
https://open.feishu.cn/open-apis scripts/x-monitor.js:8
Medium External URL
https://clawhub.ai/user/kongxiaodan20001201-alt skill-card.md:7
Medium External URL
https://clawhub.ai/kongxiaodan20001201-alt/x-daily-report skill-card.md:29
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| @the-convocation/twitter-scraper | ^0.22.1 | npm | No | Wildcard range ^0.22.1 allows updates; accesses Chrome browser cookies for X authentication (declared only in skill-card.md, not SKILL.md) |
| axios | ^1.6.0 | npm | No | Wildcard range ^1.6.0 allows updates; used for Feishu API calls with undeclared credentials |
File composition
7 files · 657 lines
JavaScript 2 files · 445 linesMarkdown 3 files · 190 linesJSON 2 files · 22 lines
Files of concern · 5
scripts/x-monitor.js Hardcoded X API Key with 'auto-obtained' comment · Undeclared Feishu API access with hardcoded App Token · x-monitor.js uses mock/simulated data that could mask real credential usage · API_KEY = 'THp2c1V4bW5JQVJ1S09IY1BzN1NubDoxaXJpUQ' · https://open.feishu.cn/open-apis
scripts/x-scraper-free.js Browser cookie access declared only in skill-card.md, absent from SKILL.md · Undeclared file write operations
SKILL.md SKILL.md claims zero-cost no-API mode but code requires credentials
skill-card.md https://clawhub.ai/user/kongxiaodan20001201-alt · https://clawhub.ai/kongxiaodan20001201-alt/x-daily-report
package.json Unpinned npm dependencies with wildcard version ranges
Other files · account-list.md · _meta.json
Security positives
No reverse shell, C2, or confirmed data exfiltration detected
skill-card.md partially documents Feishu/Bitable data destinations and Chrome session reuse as known risks
Free scraper mode uses a legitimate open-source npm package (@the-convocation/twitter-scraper) rather than custom obfuscated code
No base64-encoded execution, no direct IP network requests, no SSH/AWS credential access
Report generation logic is straightforward and readable
MIT license is declared in package.json